hostdoc — offline cPanel/WHM/WHMCS support brain

← all runbooks

---
title: Certificate expired or the site is not secure
panel: WHM / cPanel
symptoms:
  - browser says the certificate is not trusted
  - certificate expired
  - HTTPS shows the wrong domain name
  - the website says not secure
  - certificate error in the browser
  - https is broken
  - ssl expired warning
  - browser warning about the certificate
---

# Certificate expired or the site is not secure

## 1. Work out whether the certificate is actually the problem

**Why:** a warning about the wrong domain name usually means the wrong
certificate is installed rather than a bad one, and those have different
fixes. Reading the certificate off the domain tells you which of the two
you are looking at before you change anything.

**In the terminal:** `echo | openssl s_client -connect <domain>:443
-servername <domain> 2>/dev/null | openssl x509 -noout -subject -dates`

**Care:** this only reads.

## 2. Run AutoSSL for the domain

**Why:** AutoSSL issues and installs the certificate and then renews it
before it expires. That is why it is the answer rather than uploading a
certificate by hand. A hand-installed certificate has to be replaced by
hand, and if nobody does that it expires again.

**In WHM:** SSL/TLS > Manage AutoSSL. Run AutoSSL for the domain.

**In cPanel:** Security > SSL/TLS Status. Run AutoSSL for the domain.

**In the terminal:** `whm autossl_check --user=<user>` and then run
AutoSSL for the domain from Manage AutoSSL.

**Care:** running AutoSSL replaces the certificate. The site keeps
working throughout, but say that you are doing it.

- https://docs.cpanel.net/whm/ssl-tls/manage-autossl/

## 3. Run the AutoSSL check to see which domain failed

**Why:** the check names the failing part for you, which saves a lot of
guessing. It reports which domains are covered, which are failing
validation, and why, and it will tell you if the problem is a DNS
record rather than the certificate.

**In WHM:** SSL/TLS > Manage AutoSSL, then the AutoSSL check for the
account.

**In the terminal:** `/usr/local/cpanel/bin/autossl_check --user=<user>`
for one account, or `--all` for the whole server.

**Care:** this only reads.

- https://docs.cpanel.net/whm/scripts/the-autossl_check-script/

## 4. Check the provider is enabled and paid for

**Why:** AutoSSL cannot issue without a provider configured and enabled
for the server. If the provider has run out or been disabled, every
renewal fails quietly and the certificates you already have quietly
expire. This is why the same certificate keeps failing on sites that were
fine last month.

**In WHM:** SSL/TLS > Manage AutoSSL > AutoSSL Providers. The provider
column shows whether it is enabled and how much is left.

**In the terminal:** `/usr/local/cpanel/scripts/install_lets_encrypt_autossl_provider`

**Care:** changing the provider affects every certificate on the server.
Check the whole server's check output before you swap it.

- https://docs.cpanel.net/knowledge-base/cpanel-product/how-to-update-the-autossl-provider/

## 5. Check the hostname certificate

**Why:** where the server issues an automatic certificate for its own
hostname, that certificate depends on a DNS record. If the record is
missing, the hostname certificate stops being replaced at renewal and the
customer's own sites are fine while the hostname is not.

**In WHM:** SSL/TLS > Automatic Hostname Certificates.

**In the terminal:** `dig +short A <hostname>` and compare it with the
server's main IP.

**Care:** this only reads.

- https://docs.cpanel.net/knowledge-base/dns/automatic-hostname-ssl-certificate-replacement/